Flawless Compliance

Man Joins Grizzlies for Dinner

It’s about Protection, Not Compliance

The grizzly exhibit at the San Francisco Zoo. Picture Source

In the inaugural issue of Flawless Compliance (January 2008) the lead story was about a few kids that got themselves in big trouble by taunting Tatiana, a 300 pound Siberian Tiger that was minding her own business at the San Francisco Zoo on Christmas Day 2007. Well our zoo must be a magnet for people that want to get close to animals, because this month a man decided to pay his respects to a family of grizzly bears right around dinner time!

According to the San Francisco Chronicle, 21-year old Kenneth Herron either successfully negotiated a 20-foot wall topped by electrical wires or a 14-foot deep moat to interrupt a nice evening enjoyed by Kachina and Kiona, two 500 pound female grizzly bears. Nobody knows how he got in or why, but when he was spotted he was being “greeted” by one of the bears. The Chronicle reports that:

“One bear approached curiously and sniffed one of Herron's shoes. At that point, said zoo vice president Bob Jenkins, Herron did ‘the only thing he did right - he stayed still and didn't move.’”

Well of course, because anyone with common sense knows to stay still when being sniffed by a grizzly bear …

... True to protocol, the response team was dispatched to handle the situation. As with the tiger, the thing that disturbs me the most is that if the response team had sensed that Herron was in danger, they would have shot the grizzly bear. The grizzlies seem to be the only ones in this equation that aren’t insane. Fortunately for all involved the grizzlies did not follow the same fate as Tatiana who was shot and killed as a result of the incident. In this case the response team fired a warning shot and both bears scrambled back to their cave to finish watching the highlights of the LPGA tournament.

Here’s what I consider is a remarkable follow up twist to my original tiger story. Not only was the Tiger killed, but the zoo was subsequently sued and ended up settling for $900,000. Is it possible that the zoo could end up in another lawsuit as a result of this? You bet.

Think about this for a minute. The world lost a beautiful tiger and the zoo lost $900,000 because a tiger was taunted by three kids that may have been under the influence of something. We nearly lost at least one, possibly two grizzly bears and the zoo is exposed again, because some lunatic decided to invade a grizzly bear grotto.

As unfortunate as it is, this is what’s in the real world. You may think that your compliance program is good, but is it good enough to resist a deliberate, preconceived, and well-planned breach of compliance? Most organizations install good-enough controls and sleep well at night thinking they’re protected. Just like the zoo thought an 18 foot wall was good enough to keep out a tiger, or nobody would be insane enough to scale a 20 foot wall fortified with electrical wire to enter a bear cave.

You must be prepared for anything. You might have guards watching the safe, but who’s watching the guards? I’m not trying to install paranoia; instead I am trying to incite you to raise your own bar. Ironically a good compliance program is about more than just compliance—it’s about protection. An over-publicized privacy leak will be damaging, regardless of the numerous compliance points you can demonstrate. You can pass external SOX audits from each of the big four accounting firms with flying colors, and still get caught taking shareholders and employees for an egregious amount of money. Do you think they will care if you can produce a string of unqualified opinions from various big four firms?

Good enough compliance is a start, but not the end. Constantly challenge yourself to do it better. Enlist the aid of an outside firm to see if they can put your company at risk and still be compliant with your program. This is a sign that your compliance program needs to be beefed up a bit.

After the tiger incident at the SF Zoo, the executive director was forced to “explore other pursuits.” Even in the face of this psycho-Goldilocks adventure, the new executive director defends their security measures stating that they expect visitors to display some amount of common sense. Let’s see how that defense flies if they get sued. It’s not common sense they need to be worried about, it’s uncommon nonsense.

Finally, let me reiterate the bonus lesson we learned from the tiger story:

Don't mess with angry females, especially ones that outweigh you!

Who Stole my Retirement?

A New Committee Investigates the Crash of 2008

Chairman Phil Angelides, head of the Financial Crisis Inquiry Commission. Picture Source

This month marks the one year anniversary of the largest financial meltdown this generation has ever seen. Only people approaching centenarian status (only 100,000 in the entire United States) can fully “appreciate” the return of such a financial implosion. Did you lose a small fortune in 2008? Even if you didn’t I’m sure you’re curious as to how something like this could ever happen. With any luck, we’ll know the answer to that soon.

The FCIC (Financial Crisis Inquiry Commission), headed by Chairman Phil Angelides, met for the first time this month. The FCIC is a US government commission of 10 bipartisan representatives whose sole responsibility is to come up with a reason for why the financial catastrophe of 2008 happened, and what we can do to prevent something like this from happening in the future. Chairman Angelides has until the end of 2010 to come up with an answer. If this sounds like a long stretch of time to you, don’t be fooled. In actuality, 15 months is a very short time to get something of this magnitude accomplished.

According to new deal 2.0 who captured the entire text of the opening remarks, Angelides stated that:

“We have been called upon to conduct a full and fair investigation in the best interests of the nation — pursuing the truth, uncovering the facts, and providing an unbiased, historical accounting of what brought our financial system and our economy to its knees. This is what the American people deserve and this is what we are obliged to do. In this critical instance, if we do not learn from history, we are unlikely to fully recover from it.”

I’m quite sure you’re abreast of how crash of 2008 is affecting the nation, but as Angelides continues he reminds us of the devastation this financial typhoon has caused so far:

• 7 million Americans have lost their jobs in the last year
• 25 million Americans are either unemployed, under-employed, or resigned from looking anymore. This is over 16% of our total workforce.
• 10 million homes have touched the foreclosure process in the last 3 years, with 2 million homes taken as casualty.
• 13 trillion dollars of wealth evaporated last year. That’s 13,000,000,000,000 American dollars.

Angelides and his crew have a big job ahead of them, but shockingly it won’t be the first time America has been required to investigate a financial collapse of this magnitude. Angelides has been referred to as the New Pecora Commission, “affectionately” named after Ferdinand Pecora, the chief counsel and investigator for the former Senate Banking and Currency Committee. This committee was formed shortly after the financial meltdown in 1929 that caused the Great Depression. Their job—get to the root cause of what happened.

Pecora didn’t start with the committee however. In fact, he was preceded by three others who held the lead counsel position. Two were fired due to ineffectiveness, and the other resigned when denied subpoena power. According to the history books, Pecora was relentless in his investigation. In search of the truth without regard for any consequence, he opened up floodlights on the filth and grime the financial cockroaches of the time had created at the expense of the everyday, ordinary investors. The pressure of being exposed was so great on the president of National City Bank (now Citigroup) he was forced to resign. After the dust settled, Pecora published a recap of the investigation in a book called, “Wall Street Under Oath,” from which this now popular passage comes:

"Bitterly hostile was Wall Street to the enactment of the regulatory legislation. Had there been full disclosure of what was being done in furtherance of these schemes, they could not long have survived the fierce light of publicity and criticism. Legal chicanery and pitch darkness were the banker's stoutest allies."

If fortune favors the United States we’ll know the answers in days to come. This time around we have a nice head start. It didn’t take a committee or a commission to expose the historic scandal of Bernie Madoff or the AIG blowout party paid for by taxpayer dollars. That said, I’m sure we’ll dig up even more dirt on Wall Street between now and the end of 2010.

With the right roadblocks cleared, I think the new committee has a good shot of uncovering some root causes; however, if they even remotely believe that we’ll uncover the secret for preventing economic ruin in the future, they’re drinking the Kool-Aid. I hate to be negative on this, but it seems like we just went through this eighty years ago, and didn’t learn a thing. The 1929 investigation uncovered greedy bankers taking advantage of ordinary people to the point where Americans lost their jobs, retirement, and life savings. Does this sound familiar at all?

Regardless of whatever new law they come up with, or who they put in jail for the next 150 years, the sad news is, if you maintain a proper diet and exercise regularly, you might get to see this happen all over again in 2088. I hope you’re ready for it.

He Said, She Said

How to Manage Agreements on your Compliance Program

Have you ever had an auditor give you friendly guidance in one direction, then completely deny it in a follow up visit? If it hasn’t happened to you yet, don’t say I didn’t warn you. Or maybe you’re trying to partner with legal only to be whiplashed around by counsel always changing their mind but never admitting it?

The grim reality on all projects and programs is that stakeholders will sometimes alter or go back on something they said but to avoid taking responsibility for the impact of the change will deny that you ever had a previous agreement. Unfortunately, this happens to be especially true in compliance programs.

It seems odd to make a statement like that about compliance programs; because if you didn’t know better you would think just the opposite. Compliance is about following laws, and laws don’t change so why do requirements? Actually laws do change, but that’s not the real problem because they don’t change that often. Your requirement is not based on the law, it’s based on a policy which is in turn based on the interpretation of a law. Laws are notoriously vague and ambiguous so in order to construct a policy you must have somebody try to interpret what the law really means. Of course, every time somebody looks at it a different way, there’s a different interpretation and subsequently different rules built into the policy. And just when you get more than one lawyer to agree on the interpretation, the law gets challenged in court with a surprising outcome (of course), and the interpretation changes again.

Okay fine, then if things change and we all know it, why is it so hard for stakeholders to admit that the change is being caused by them? This question is actually being approached from the wrong angle to see the truth. You should be asking, “why is it so easy for stakeholders to deny what they said in the past.”

Honestly, you’re at the base of your own problem and that’s actually a good thing. Unless you’re running a highly evolved project or program (and I haven’t seen too many in my lifetime), change is painful and nobody wants to be accountable for causing pain. Let’s face it. We’re all just trying to get it done, whatever it is. Change is just going to cause delays and cost more money, so why would anybody want to take ownership of that? It’s much easier to just stay in denial.

Correcting this problem is pretty easy; jus t install an agreements registry on your project or program. An agreements registry is just a log of all the agreements, formal or informal, that were made during the course of progress, from the initial kickoff meeting forward. When you setup each meeting, think about any agreements that need to be reached in the meeting, and announce them in the agenda. In the meeting minutes, simply record what was agreed to. Make sure when you send out the minutes, you call special attention to the agreements section and give stakeholders the opportunity to correct any misunderstanding. This is called negative assurance, meaning if nobody says anything the agreements stand.

Now you’re covered. When the stakeholders pull the old Alzheimer’s bit on you, gently remind them of the documented agreement that was previously made. Don’t be antagonistic; you don’t want to break down the relationship. Just refresh everybody’s memory as to what was agreed.

Please note that this doesn’t give you a clean pass on never having to deal with people backing out of an agreement, it just makes it harder to lie about it. I was on a very high-profile project when a VP flat out refused to honor an agreement that was documented in my agreements registry. What can you do? Well, at least they couldn’t say they never agreed to it in the first place.

I find it ironic that we deal with contracts all day long, but we don’t take care of the most important contracts—the contracts, formal or informal, between us and our stakeholders. A simple agreements registry will do the trick, so why not install one today.

Financier Fingered for Fancy Funny-Business

AIG Executive Up on Charges

Joseph Cassano, Former AIG Executive in charge of credit default swaps. Picture Source

Joseph Cassano is in the soup this month for, none other than, financial fraud. According to the Wall Street Journal:

“The Justice Department and the Securities and Exchange Commission have been investigating whether Joseph Cassano, whose AIG Financial Products unit nearly brought down the insurer a year ago, committed securities fraud in allegedly misleading investors by overstating the value of mortgage-related contracts and failing to disclose material facts about them to AIG's outside auditor, the people said.”

Really? Would he really do that to us?

Keep in mind he hasn’t been convicted of anything, but based on recent and not-so recent history, I don’t think he’s going to fare very well here.

The key thing I wanted to point out here is the lack of disclosure. Albeit somewhat exaggerated, this is an example of how not doing something can really get you into trouble. I’m seeing this more and more as America clamps down on oversight and regulation. Please make sure to disclose absolutely everything you know, even if you think it might incriminate you. Fines for not disclosing are the ones that cut the deepest.

Oh, and don’t cry for Mr. Cassano. When forced to retire, he floated down under a $315 million golden parachute.

What’s Wrong with a Family Gun Collection?

What Works for Today Won’t Work for Tomorrow

Here’s an old Daisy ad (not the milk!) I found in the way-back machine, maybe circa 1960?

A Daisy Ad, probably from the 1960's. Picture Source

Just a reminder that times change, so make sure to keep your policies up to date!